mass.report
Scan Intelligence Report0/100
high Risk
getverified4.top
https://getverified4.top
IP
104.21.41.127 · Cloudflare, Inc.
Location
Toronto, Canada
Domain Age
4 days ⚠
HTTP
200 · 34.9s
SSL
Valid· E8, Let's Encrypt, US
Status
COMPLETED
Linked Phishing Report
This scan is attached to a vendor submission report
Brand
Vendors
29/31
Status
partial
✗ threatyeti✓ phishreport✓ urlquery✓ virustotal✓ isitphish✓ urlabuse✓ phishtank✓ polyswarm✓ sophos✓ spamhaus✓ apple✓ eset✓ yandex✓ brightcloud✓ cisa✓ avast✓ chainpatrol✓ microsoft✗ norton✓ avg✓ bitdefender✓ netcraft✓ emsisoft✓ apwg✓ urlscan✓ openphish✓ drweb✓ mcafee✓ kaspersky✓ google✓ fortiguard
KB/IOK Matches (0)—
No KB/IOK detections were recorded for this scan.
technology | finance | ecommerce | other · 4/29/2026
Summary
The page presents Google Doğrulama with Google branding and includes Google scripts and an embedded verification UI. However, the domain getverified4.top is new (4 days old) and uses a top-level domain (.top). The HTML shows an embedded Google widget and a single form-like element, but there is no explicit login credential capture; the POST endpoint and exfil behavior suggest data collection through the Google flow. This could be a legitimate Google integration on a suspicious domain, or an impersonation/phishing page designed to harvest PII via the Google flow. The presence of Google.me script assets and a Google iframe-like container strongly hints at branding cloning, but the domain misalignment (brand shown vs. domain) raises impersonation concern. The evidence indicates potential credential or PII collection under Google branding on a questionable domain.
Evidence Summary
▸Observed 3 capture stage(s); canonical stage is late_render_3s.
▸POST targets observed during capture: https://getverified4.top/cdn-cgi/rum?.
▸Distinctive asset clues: veriff.js, veriff.min.js, css2.
Capture
Stages: 3
Canonical: Late Render (+3s)
Changed: No
Credential Signals
Forms: 1
Password fields: 0
Late-stage login UI: No
Resource Signals
Resources: 11
Hosts: 5
Domains: 5
Suspicious Endpoints
hxxps://getverified4[.]top/
Attack Techniques (4)
Branding/signature cloning (Google) on a non-official domainClient-side identity verification widget injection (Google incontext/iframe integration)Data collection through a verification form (Tc No field and Given/Last name) within a Google flowUse of a publicly hosted Google SDK (Google.min.js, Google.js) loaded from cdn.Google.me
Indicators of Compromise (9)
▸Page title: Google Doğrulama
▸External scripts loaded from cdn.Google.me (Google.min.js, Google.js)
▸Google root element and inline styles mimicking a verification widget
▸Form fields labeled Given name, Last name, Tc No (Turkish national ID), and Start Verification button
▸Footer description references Google as identity verification provider
▸Domain age: 4 days; TLD .top (high risk indicator)
▸SSL certificate issued by Let's Encrypt and valid for a short period
▸POST request to /cdn-cgi/rum? observed (likely analytics/rumor beacon) with 204
▸IP address resolved via Cloudflare (edge) and the host uses Cloudflare nameservers
Risk AssessmentUsed in abuse reports
The page presents a Google-enabled identity verification UI on a domain that is only 4 days old and uses a .top TLD, which is a high-risk indicator for suspicious activity. The branding aligns with Google, and the page loads Google’s SDKs, suggesting an integration intended to collect identity data (Given name, Last name, Tc No). While it could be a legitimate integration, the combination of a new, suspicious domain and a minimal site footprint increases risk of impersonation or malicious data collection. The presence of a visible form labeled for personal data alongside Google branding warrants containment actions and further verification of domain ownership and legitimate business use.
Recommended Action
Suspend Domain
Cross-Reference9
URL Intelligence
Domain Intelligence
IP Intelligence
Public threat feed available — JSON API